function verifyYallaPaySignature(string $header, string $rawBody, string $secretKey): bool
{
    $parts = [];
    foreach (explode(',', $header) as $segment) {
        [$k, $v] = array_pad(explode('=', $segment, 2), 2, '');
        $parts[trim($k)] = trim($v);
    }

    $t  = (int) ($parts['t'] ?? 0);
    $v1 = $parts['v1'] ?? '';
    if ($t <= 0 || $v1 === '' || abs(time() - $t) > 300) {
        return false;
    }

    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secretKey);
    return hash_equals($expected, $v1);
}

// Laravel
$rawBody = $request->getContent();
$ok = verifyYallaPaySignature($request->header('X-YallaPay-Signature', ''), $rawBody, env('YALLAPAY_SECRET_KEY'));

import crypto from 'node:crypto';

export function verifyYallaPaySignature(header, rawBody, secretKey) {
  const parts = Object.fromEntries(
    header.split(',').map(s => { const i = s.indexOf('='); return [s.slice(0, i).trim(), s.slice(i + 1).trim()]; })
  );
  const t = Number(parts.t || 0);
  const v1 = parts.v1 || '';
  if (!t || !v1 || Math.abs(Date.now() / 1000 - t) > 300) return false;

  const expected = crypto.createHmac('sha256', secretKey).update(`${t}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express: keep the raw body — do not let a JSON middleware re-serialise it
app.post('/webhooks/yallapay', express.raw({ type: 'application/json' }), (req, res) => {
  const raw = req.body.toString('utf8');
  if (!verifyYallaPaySignature(req.get('X-YallaPay-Signature') || '', raw, process.env.YALLAPAY_SECRET_KEY)) {
    return res.status(401).end();
  }
  const event = JSON.parse(raw);
  // ...
  res.status(200).end();
});

import hmac, hashlib, time

def verify_yallapay_signature(header: str, raw_body: bytes, secret_key: str) -> bool:
    parts = dict(s.strip().split("=", 1) for s in header.split(",") if "=" in s)
    try:
        t = int(parts.get("t", "0"))
    except ValueError:
        return False
    v1 = parts.get("v1", "")
    if t <= 0 or not v1 or abs(time.time() - t) > 300:
        return False

    msg = f"{t}.".encode() + raw_body
    expected = hmac.new(secret_key.encode(), msg, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

# Flask
@app.post("/webhooks/yallapay")
def yallapay_webhook():
    if not verify_yallapay_signature(request.headers.get("X-YallaPay-Signature", ""), request.get_data(), os.environ["YALLAPAY_SECRET_KEY"]):
        abort(401)
    event = request.get_json(force=True)
    # ...
    return "", 200

function verifyYallaPayReturn(array $query, string $secretKey): bool
{
    $presented = $query['signature'] ?? '';
    unset($query['signature']);
    $query = array_filter($query, fn ($v) => $v !== null && $v !== '');
    ksort($query);

    $keyMaterial = preg_replace('/^sk_(live|test)_/', '', $secretKey);
    $expected = hash_hmac('sha256', urldecode(http_build_query($query)), $keyMaterial);

    return $presented !== '' && hash_equals($expected, $presented);
}

import crypto from 'node:crypto';

export function verifyYallaPayReturn(query, secretKey) {
  const { signature = '', ...rest } = query;
  const payload = Object.keys(rest)
    .filter(k => rest[k] !== undefined && rest[k] !== null && rest[k] !== '')
    .sort()
    .map(k => `${k}=${rest[k]}`)
    .join('&');

  const keyMaterial = secretKey.replace(/^sk_(live|test)_/, '');
  const expected = crypto.createHmac('sha256', keyMaterial).update(payload).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(signature);
  return signature !== '' && a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib, re

def verify_yallapay_return(query: dict, secret_key: str) -> bool:
    presented = query.get("signature", "")
    rest = {k: v for k, v in query.items() if k != "signature" and v not in (None, "")}
    payload = "&".join(f"{k}={rest[k]}" for k in sorted(rest))

    key_material = re.sub(r"^sk_(live|test)_", "", secret_key)
    expected = hmac.new(key_material.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return bool(presented) and hmac.compare_digest(expected, presented)